ThreadFlip is a Chrome extension that repurposes selected text into social media content. This policy explains what data ThreadFlip accesses, how it is used, and where it is stored.
When you right-click and choose "Repurpose with ThreadFlip" (or use the keyboard shortcut), the extension reads only the text you have highlighted via the browser's window.getSelection() API. ThreadFlip does not access any other page content, DOM elements, cookies, passwords, form inputs, or browsing history.
The URL and page title of the tab where you made a selection are captured alongside the selected text. This is used solely to:
You provide the following voluntarily in the settings page:
All data is stored locally in your browser using Chrome's built-in storage APIs:
| Data | Storage Location | Scope |
|---|---|---|
| Settings (name, role, audience, etc.) | chrome.storage.sync | Synced across signed-in Chrome devices |
| OpenAI API key (encrypted) | chrome.storage.sync | Synced across signed-in Chrome devices |
| Content library (saved generations) | chrome.storage.local | Local to this device only |
| Generation usage counter | chrome.storage.sync | Synced across signed-in Chrome devices |
If you use the Bring Your Own Key (BYO) option, your OpenAI API key is encrypted before storage using:
The plaintext key is never stored. It is decrypted in-memory only at the moment an API call is made, then discarded.
Generated outputs can optionally be saved to a local content library. Each entry stores:
The library retains a maximum of 200 entries. Older entries are automatically removed when the limit is reached. You can delete individual entries or clear the entire library from the settings page.
When you click "Generate" or "Rewrite", the selected text (after cleanup) is sent to OpenAI's API (api.openai.com) along with a system prompt that includes your configured role, audience, and voice adjectives.
ThreadFlip does not send your data to any other third-party service.
If you enter a Pro license key, ThreadFlip sends only the license key string to a Cloudflare Worker endpoint (threadflip-license.workers.dev) to verify its validity. No personal data, selected text, or generated content is included in this request.
ThreadFlip does not collect, transmit, or store:
| Permission | Why It's Needed |
|---|---|
contextMenus | Register the "Repurpose with ThreadFlip" right-click menu item |
sidePanel | Open and manage the persistent side panel UI |
storage | Store settings, encrypted API key, and content library locally |
activeTab | Read the current tab's URL to detect the source platform |
scripting | Inject a lightweight script to capture your text selection when the context menu is clicked |
<all_urls> | Allow the content script to run on any page so selection capture works universally |
The <all_urls> permission is required because users select text on arbitrary websites. The content script (selector.js) does only one thing: listen for text selections and forward them to the side panel. It does not read, modify, or exfiltrate any other page data.
chrome.storage.local data. chrome.storage.sync data is removed when you sign out of Chrome or manually clear extension data.You can export your content library as CSV or Markdown at any time from the settings page before deleting.
ThreadFlip is not directed at children under 13. We do not knowingly collect data from children.
If this privacy policy changes, the updated version will be published with a new "Last Updated" date. Continued use of the extension after changes constitutes acceptance.
Questions or data deletion requests?